If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (5bf8fb109bddeaac7b9818f893783456619c44562c50fe26abea906cbc1ef06a)
Packages exfiltrate the diff of the current repository. The code in "main.py" suggests it's not a real attempt to provide AI-generated commit message, but a security research attempting to leverage typosquatting.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: 2024-08-old-bitcommit
Reasons (based on the campaign):
- exfiltration-generic
- typosquatting
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- yl4zicglte[.]execute-api[.]us-east-1[.]amazonaws[.]com other packages →
URLs
- hxxps://yl4zicglte[.]execute-api[.]us-east-1[.]amazonaws[.]com/predict/commit other packages →